This is a note to let you know that I've just added the patch titled
USB: ark3116: fix use-after-free in TIOCMIWAIT
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-ark3116-fix-use-after-free-in-tiocmiwait.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 923ab36b14cb557482a079b0d67ef80f90bbc410 Mon Sep 17 00:00:00 2001
From: Johan Hovold <jhovold@xxxxxxxxx>
Date: Tue, 19 Mar 2013 09:21:11 +0100
Subject: USB: ark3116: fix use-after-free in TIOCMIWAIT
From: Johan Hovold <jhovold@xxxxxxxxx>
commit 5018860321dc7a9e50a75d5f319bc981298fb5b7 upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
Signed-off-by: Johan Hovold <jhovold@xxxxxxxxx>
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
Cc: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/serial/ark3116.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -68,7 +68,6 @@ static int is_irda(struct usb_serial *se
}
struct ark3116_private {
- wait_queue_head_t delta_msr_wait;
struct async_icount icount;
int irda; /* 1 for irda device */
@@ -148,7 +147,6 @@ static int ark3116_attach(struct usb_ser
if (!priv)
return -ENOMEM;
- init_waitqueue_head(&priv->delta_msr_wait);
mutex_init(&priv->hw_lock);
spin_lock_init(&priv->status_lock);
@@ -460,10 +458,14 @@ static int ark3116_ioctl(struct tty_stru
case TIOCMIWAIT:
for (;;) {
struct async_icount prev = priv->icount;
- interruptible_sleep_on(&priv->delta_msr_wait);
+ interruptible_sleep_on(&port->delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+ if (port->serial->disconnected)
+ return -EIO;
+
if ((prev.rng == priv->icount.rng) &&
(prev.dsr == priv->icount.dsr) &&
(prev.dcd == priv->icount.dcd) &&
@@ -584,7 +586,7 @@ static void ark3116_update_msr(struct us
priv->icount.dcd++;
if (msr & UART_MSR_TERI)
priv->icount.rng++;
- wake_up_interruptible(&priv->delta_msr_wait);
+ wake_up_interruptible(&port->delta_msr_wait);
}
}
Patches currently in stable-queue which might be from jhovold@xxxxxxxxx are
queue-3.4/usb-oti6858-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-io_ti-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-ch341-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-io_edgeport-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-ftdi_sio-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-ark3116-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-pl2303-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-cypress_m8-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-ssu100-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-mct_u232-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-spcp8x5-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-ti_usb_3410_5052-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-mos7840-fix-broken-tiocmiwait.patch
queue-3.4/usb-serial-fix-hang-when-opening-port.patch
queue-3.4/usb-mos7840-fix-use-after-free-in-tiocmiwait.patch
queue-3.4/usb-serial-add-modem-status-change-wait-queue.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html